# Does our cluster's design support Interactive Desktop?

**URL:** <https://discourse.openondemand.org/t/does-our-clusters-design-support-interactive-desktop/4336>\
**Category:** Get Help\
**Created:** [July 2, 2025, 8:33pm UTC](https://discourse.openondemand.org/t/does-our-clusters-design-support-interactive-desktop/4336 "2025-07-02T20:33:06Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![infinity01](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/infinity01/32/2820_2.png) [@infinity01](https://discourse.openondemand.org/u/infinity01)\
**Post date:** [July 2, 2025, 8:33pm UTC](https://discourse.openondemand.org/t/does-our-clusters-design-support-interactive-desktop/4336/1 "2025-07-02T20:33:06Z")

</div>

Hello!

Been scouring the forums to find someone with a similar problem but can’t seam to find a solution.

I am trying to configure an interactive desktop (XFCE) to our computer nodes. I think I’m 99% there, but when i start a desktop and click on Launch, the new tab opens the VNC with error:  
“Failed to connect to Server”

Our Open OnDemand server is running on its own separate VM and only has access to the HPC login (head) node, as well as the shared NFS datastores.  
The compute nodes are on their own isolated 10.0.0/24 network, but can connect to services externally through the head nodes thru NAT. The OOD server cant connect directly to the compute nodes since there on a private subnet.

I tried to configure the OOD server with reverse proxy configuration, but that did not solve it either.

> **[3. Enable Reverse Proxy — Open OnDemand 4.0.0 documentation](https://osc.github.io/ood-documentation/latest/how-tos/app-development/interactive/setup/enable-reverse-proxy.html)**

Is this even possible with the design we have?

Thanks in advance,  
Ivan

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [July 2, 2025, 9:05pm UTC](https://discourse.openondemand.org/t/does-our-clusters-design-support-interactive-desktop/4336/2 "2025-07-02T21:05:16Z")

</div>

> [@infinity01](#):
>
> The OOD server cant connect directly to the compute nodes since there on a private subnet.

Yea I think that’s it. The flow is

`you the client -> OOD apache -> the compute node.`

We use apache as a point of entry to proxy requests from it to the compute nodes. This is so you can connect to the services running on the compute nodes (like websockify in the case of desktops/VNC applications) instead of connecting directly to the compute node.

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [July 2, 2025, 9:05pm UTC](https://discourse.openondemand.org/t/does-our-clusters-design-support-interactive-desktop/4336/3 "2025-07-02T21:05:38Z")

</div>

Also Hi and welcome!

---

<div class="post-metadata">

**Author:** ![infinity01](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/infinity01/32/2820_2.png) [@infinity01](https://discourse.openondemand.org/u/infinity01)\
**Post date:** [July 2, 2025, 9:21pm UTC](https://discourse.openondemand.org/t/does-our-clusters-design-support-interactive-desktop/4336/4 "2025-07-02T21:21:06Z")

</div>

@jeff.ohrstrom Thanks for the confirmation.

I thought maybe the “reverse” proxy referred to the compute node initiating the connection back to the OOD server, not vice versa

Where do most institutions install OOD?

- On the head node?
- On a dedicated physical server in the same subnet as the computes nodes?

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [July 3, 2025, 1:23pm UTC](https://discourse.openondemand.org/t/does-our-clusters-design-support-interactive-desktop/4336/5 "2025-07-03T13:23:41Z")

</div>

I can’t really speak to ‘most’ as I have no visibility into any center, only what I can glean from discourse topics and so on.

But I would say deploying on VMs are quite popular. Head node installations are viable but you just need to take a little care as you have folks sshing into it as well and so there’s a lot of CPU & memory competition between OOD and ssh users.

---

<div class="post-metadata">

**Author:** ![snowbird294](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/snowbird294/32/2099_2.png) [@snowbird294](https://discourse.openondemand.org/u/snowbird294)\
**Post date:** [July 9, 2025, 4:29pm UTC](https://discourse.openondemand.org/t/does-our-clusters-design-support-interactive-desktop/4336/6 "2025-07-09T16:29:26Z")

</div>

To chime in. Our OOD instances live on the same net as our login/interface nodes, and our compute nodes live on a private net.

What configuration do you have in the ood config for determining node name, and what does your regex match on OOD look like?

> /etc/ood/config/ood\_portal.yml “host\_regex”

and

> /etc/ood/config/clusters.d/name.yml “set\_host”

---

<div class="post-metadata">

**Author:** ![infinity01](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/infinity01/32/2820_2.png) [@infinity01](https://discourse.openondemand.org/u/infinity01)\
**Post date:** [July 9, 2025, 4:46pm UTC](https://discourse.openondemand.org/t/does-our-clusters-design-support-interactive-desktop/4336/7 "2025-07-09T16:46:57Z")

</div>

Hey @snowbird294 really appreciate the reply! Sounds like it might be possible then? 😀

Right now i have it open to any name just to make sure it works, but we have nodes with hostnames starting with ‘node’ and ‘gpu’ so i will be chaning it in the future

```auto
host_regex: '[^/]+'
node_uri: '/node'
rnode_uri: '/rnode'

```

In the ../clusters.d .. file i have (just realized i have it set twice, not sure it matters?)

```auto
   batch_connect:
     basic:
       script_wrapper: |
         module purge
         %s
       set_host: "host=$(hostname -A | awk '{print $1}')"
     vnc:
       script_wrapper: |
         module purge
         export PATH="/usr/local/bin/TurboVNC:$PATH"
         export WEBSOCKIFY_CMD="/usr/local/bin/websockify/run"
         %s
       set_host: "host=$(hostname -A | awk '{print $1}')"

```

Thanks again!

---

<div class="post-metadata">

**Author:** ![snowbird294](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/snowbird294/32/2099_2.png) [@snowbird294](https://discourse.openondemand.org/u/snowbird294)\
**Post date:** [July 9, 2025, 4:53pm UTC](https://discourse.openondemand.org/t/does-our-clusters-design-support-interactive-desktop/4336/8 "2025-07-09T16:53:49Z")

</div>

there might be an issue with regex matching, based on the warning on this page:

> **[3. Enable Reverse Proxy — Open OnDemand 4.0.0 documentation](https://osc.github.io/ood-documentation/latest/how-tos/app-development/interactive/setup/enable-reverse-proxy.html)**

Put a specific hostname in that regex, and test with that specific host, see if it works with the reverse proxy test

```auto
ssh <name>
hostname -A | awk '{print $1}'
nc -l 54321

```

then in the regex, put the output from the hostname, regen the portal, reload, and navigate to the page:  
`myood.net/node/<name>`

If it doesn’t spew something in the listener terminal, then you don’t have a route at all to the compute, and you may want to bother your network person to get their thoughts.

---

<div class="post-metadata">

**Author:** ![infinity01](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/infinity01/32/2820_2.png) [@infinity01](https://discourse.openondemand.org/u/infinity01)\
**Post date:** [July 9, 2025, 5:17pm UTC](https://discourse.openondemand.org/t/does-our-clusters-design-support-interactive-desktop/4336/9 "2025-07-09T17:17:49Z")

</div>

Ok so i changed it to:

`host_regex: '(node|gpu)\d+'`

That should work right?

Also our OOD server is running in a VM cluster without direct access to the compute nodes so I think that’s my main issues.

Does your OOD server/instance have two interfaces?  
One public and one private that connects to the same switch as your compute hosts?

---

<div class="post-metadata">

**Author:** ![snowbird294](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/snowbird294/32/2099_2.png) [@snowbird294](https://discourse.openondemand.org/u/snowbird294)\
**Post date:** [July 9, 2025, 5:37pm UTC](https://discourse.openondemand.org/t/does-our-clusters-design-support-interactive-desktop/4336/10 "2025-07-09T17:37:09Z")

</div>

It’s a single interface.

When you say no direct access, is there a route at all? do the compute nodes resolve with “hostname node-xyz”? can you ping one?

---

<div class="post-metadata">

**Author:** ![infinity01](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/infinity01/32/2820_2.png) [@infinity01](https://discourse.openondemand.org/u/infinity01)\
**Post date:** [July 10, 2025, 3:40pm UTC](https://discourse.openondemand.org/t/does-our-clusters-design-support-interactive-desktop/4336/11 "2025-07-10T15:40:09Z")

</div>

@snowbird294 Yeah unfortunately they’re not reachable by the OOD instance so will need to work with our network/firewall team to make that private net routable.

---

<div class="post-metadata">

**Author:** ![mjbludwig](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/mjbludwig/32/684_2.png) [@mjbludwig](https://discourse.openondemand.org/u/mjbludwig)\
**Post date:** [July 16, 2025, 5:28pm UTC](https://discourse.openondemand.org/t/does-our-clusters-design-support-interactive-desktop/4336/12 "2025-07-16T17:28:53Z")

</div>

OOD effectively is a login node so most sites will often have a login node (or multiple), a DTN node and an OOD node that all have interfaces that are either public or exposed to an Institute or campus network and then an interface that is internal to the compute resources.

How do you normally have users login and submit jobs?

---

<div class="post-metadata">

**Author:** ![infinity01](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/infinity01/32/2820_2.png) [@infinity01](https://discourse.openondemand.org/u/infinity01)\
**Post date:** [July 31, 2025, 4:06pm UTC](https://discourse.openondemand.org/t/does-our-clusters-design-support-interactive-desktop/4336/13 "2025-07-31T16:06:24Z")

</div>

Hi @mjbludwig

Our current setup is users connect directly to the head node which has a public and internal interface.

---

<div class="post-metadata">

**Author:** ![mjbludwig](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/mjbludwig/32/684_2.png) [@mjbludwig](https://discourse.openondemand.org/u/mjbludwig)\
**Post date:** [July 31, 2025, 4:18pm UTC](https://discourse.openondemand.org/t/does-our-clusters-design-support-interactive-desktop/4336/14 "2025-07-31T16:18:24Z")

</div>

The internal interface on the head-node is on the compute network and can reach nodes right? If so, OOD needs to be setup the same way.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/b/bae70bd0ed39a3ae769c2108155f4cb3e9da8385.png) [@system](https://discourse.openondemand.org/u/system)\
**Post date:** [January 27, 2026, 4:18pm UTC](https://discourse.openondemand.org/t/does-our-clusters-design-support-interactive-desktop/4336/15 "2026-01-27T16:18:48Z")

</div>

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.